55 matches found
CVE-2026-102142 Kiteworks Core Remote Code Execution through Server-Side Template Injection
A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions contained in the stored template body. An authenticated System Administrator could potentially store a crafted template that executed operating-system commands on the appliance...
CVE-2026-102142 Kiteworks Core Remote Code Execution through Server-Side Template Injection
A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions contained in the stored template body. An authenticated System Administrator could potentially store a crafted template that executed operating-system commands on the appliance...
CVE-2026-102142
The Kiteworks appliance is vulnerable to Remote Code Execution due to a Server-Side Template Injection flaw in the system notification template rendering process. The underlying cause is a template engine that evaluates expressions contained within the stored template body. An authenticated Syste...
CVE-2026-100272
In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues...
CVE-2026-100274
In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template...
EUVD-2026-90018
In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template...
CVE-2026-100274
In JetBrains YouTrack versions prior to 2026.2.19197 , a project Admin can trigger a Denial of Service (DoS) condition. The root cause involves the use of a notification template . The CVSS v3.1 score is 6.5 (MEDIUM) , with a high impact on availability via a network vector requiring low privileg...
CVE-2026-100274
In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template...
EUVD-2026-90016
In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues...
CVE-2026-100272
In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues...
CVE-2026-100272
In JetBrains YouTrack versions before 2026.2.19197 , a lack of missing authorisation in the notification template preview feature allows Project Administrators to read restricted issues . The impact is categorized as High for confidentiality. Remediation is available in version 2026.2.19197 or la...
PT-2026-103319
šØ CVE-2026-100272 In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues š@cveNotify...
PT-2026-103321
šØ CVE-2026-100274 In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template š@cveNotify...
CVE-2026-102142: Improper Neutralization of Special Elements Used in a Template Engine
A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions contained in the stored template body. An authenticated System Administrator could potentially store a crafted template that executed operating-system commands on the appliance...
CVE-2026-100274: Allocation of Resources Without Limits or Throttling
In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template...
CVE-2026-100272: Authorization Bypass Through User-Controlled Key
In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues...
automation-controller: automation-controller-container: automation-controller: notification template password fields can be decrypted by a notification-template administrator by replaying encrypted values across subfields, exposing plaintext Slack, PagerDuty, Twilio, AWS SNS and Grafana credentials
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Notification template password fields are encrypted with a key derived from the secret key, the object primary key, and the field name, but not the subfield name, and the API returns the full ciphertext of a passwor...
automation-controller: automation-controller-container: automation-controller: Notification template Jinja whitelist bypass via conditional gating leaks tracebacks
Notification template Jinja AST whitelist only inspects static Getattr nodes. Dynamic subscripts job'job'+'env' and % if job.id 100 % conditional gating bypass both the AST check and the test-render stub has small job.id. At runtime, the gated branch executes and exceptions write full tracebacks...
automation-controller: automation-controller-container: automation-controller: notification template password fields can be decrypted by a notification-template administrator by replaying encrypted values across subfields, exposing plaintext Slack, PagerDuty, Twilio, AWS SNS and Grafana credentials
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Notification template password fields are encrypted with a key derived from the secret key, the object primary key, and the field name, but not the subfield name, and the API returns the full ciphertext of a passwor...
CVE-2026-71463
Notification template Jinja AST whitelist only inspects static Getattr nodes. Dynamic subscripts job'job'+'env' and % if job.id 100 % conditional gating bypass both the AST check and the test-render stub has small job.id. At runtime, the gated branch executes and exceptions write full tracebacks...